Some checks failed
ARM64 Build / Build generic ARM64 disk image (push) Failing after 4s
CI / Go Tests (push) Successful in 1m29s
CI / Shellcheck (push) Successful in 48s
CI / Build Go Binaries (amd64, linux, linux-amd64) (push) Successful in 1m12s
CI / Build Go Binaries (arm64, linux, linux-arm64) (push) Has been cancelled
Phase 8 of v0.3. Tightens the update lifecycle on both ends. Pre-flight (apply.go, before any download): - Free-space check on the passive partition: image size + 10% headroom must be available. Uses statfs(2) via the new pkg/partition.FreeBytes / HasFreeSpaceFor helpers (tests cover happy path, tiny request, huge request, missing path). Catches corrupted-FS and shrunk-partition cases before we destroy the existing slot data. - Node-block-label check: refuses if the local K8s node carries the updates.kubesolo.io/block=true label. New pkg/health.CheckNodeBlocked shells out to kubectl per the project's zero-deps stance. Silently bypassed when no kubeconfig is reachable (air-gap case). Skipped by --force. Healthcheck (extended via new pkg/health/extended.go + preflight.go): - CheckKubeSystemReady waits until every kube-system pod has held the Running phase for >= N seconds (default 30). Catches "started ok, will crash-loop" bugs that a single-shot phase check misses. - CheckProbeURL fetches an operator-supplied URL; 200 = pass. Wired through update.conf as healthcheck_url= and cloud-init updates.healthcheck_url. - CheckDiskWritable writes/fsyncs/reads a 1-KiB probe under /var/lib/kubesolo. Always runs in healthcheck so a wedged data partition fails fast. - pkg/health.Status grows KubeSystemReady, ProbeURL, DiskWritable booleans. Optional checks default to true in RunAll() so they don't block when unconfigured. health_test.go updated to the new 6-field shape. Auto-rollback (healthcheck.go): - state.UpdateState gains HealthCheckFailures (consecutive post-Activated failures). Reset on a clean pass. - --auto-rollback-after N (also auto_rollback_after= in update.conf) triggers env.ForceRollback() when the failure count reaches the threshold. State transitions to RolledBack with a descriptive LastError. The command still exits with the healthcheck error; the operator/init is expected to reboot. - Only fires while Phase == Activated. Doesn't second-guess a long-stable system that happens to fail one healthcheck. config / opts / cloud-init plumbing: - update.conf gains healthcheck_url= and auto_rollback_after= keys. - New CLI flags: --healthcheck-url, --auto-rollback-after, --kube-system-settle. - cloud-init full-config.yaml documents the new updates: subfields. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
106 lines
2.8 KiB
Go
106 lines
2.8 KiB
Go
// Package config parses /etc/kubesolo/update.conf — the persistent
|
|
// configuration for the update agent. Each line is "key = value"; blank
|
|
// lines and "#"-prefixed comments are ignored. Unknown keys are tolerated
|
|
// (forward compatibility).
|
|
//
|
|
// Example:
|
|
//
|
|
// # Where to look for updates
|
|
// server = https://updates.kubesolo.example.com
|
|
// channel = stable
|
|
//
|
|
// # Only apply between 03:00 and 05:00 local time
|
|
// maintenance_window = 03:00-05:00
|
|
//
|
|
// pubkey = /etc/kubesolo/update-pubkey.hex
|
|
//
|
|
// The file is populated on first boot by cloud-init (see the cloud-init
|
|
// updates: block) and can be hand-edited afterwards.
|
|
package config
|
|
|
|
import (
|
|
"bufio"
|
|
"fmt"
|
|
"os"
|
|
"strings"
|
|
)
|
|
|
|
// DefaultPath is where update.conf lives on a live system.
|
|
const DefaultPath = "/etc/kubesolo/update.conf"
|
|
|
|
// Config holds the parsed update.conf values. Empty fields mean "not set" —
|
|
// the caller's defaults apply.
|
|
type Config struct {
|
|
Server string
|
|
Channel string
|
|
MaintenanceWindow string
|
|
PubKey string
|
|
// HealthcheckURL is an optional URL the healthcheck command will GET;
|
|
// 200 = pass, anything else = fail.
|
|
HealthcheckURL string
|
|
// AutoRollbackAfter is the number of consecutive post-boot healthcheck
|
|
// failures after which the agent will call Rollback automatically.
|
|
// 0 = disabled (default).
|
|
AutoRollbackAfter int
|
|
}
|
|
|
|
// Load reads and parses update.conf. A missing file returns an empty Config
|
|
// (not an error) — fresh systems before cloud-init has run.
|
|
func Load(path string) (*Config, error) {
|
|
f, err := os.Open(path)
|
|
if err != nil {
|
|
if os.IsNotExist(err) {
|
|
return &Config{}, nil
|
|
}
|
|
return nil, fmt.Errorf("open %s: %w", path, err)
|
|
}
|
|
defer f.Close()
|
|
|
|
c := &Config{}
|
|
scanner := bufio.NewScanner(f)
|
|
lineNo := 0
|
|
for scanner.Scan() {
|
|
lineNo++
|
|
line := strings.TrimSpace(scanner.Text())
|
|
if line == "" || strings.HasPrefix(line, "#") {
|
|
continue
|
|
}
|
|
eq := strings.IndexByte(line, '=')
|
|
if eq < 0 {
|
|
return nil, fmt.Errorf("%s:%d: missing '=' in line: %q", path, lineNo, line)
|
|
}
|
|
key := strings.TrimSpace(line[:eq])
|
|
value := strings.TrimSpace(line[eq+1:])
|
|
switch key {
|
|
case "server":
|
|
c.Server = value
|
|
case "channel":
|
|
c.Channel = value
|
|
case "maintenance_window":
|
|
c.MaintenanceWindow = value
|
|
case "pubkey":
|
|
c.PubKey = value
|
|
case "healthcheck_url":
|
|
c.HealthcheckURL = value
|
|
case "auto_rollback_after":
|
|
// Parse a small integer. Non-numeric values are silently
|
|
// ignored (forward compat); zero disables the feature.
|
|
n := 0
|
|
for _, ch := range value {
|
|
if ch >= '0' && ch <= '9' {
|
|
n = n*10 + int(ch-'0')
|
|
} else {
|
|
n = 0
|
|
break
|
|
}
|
|
}
|
|
c.AutoRollbackAfter = n
|
|
}
|
|
// Unknown keys are silently ignored for forward compatibility.
|
|
}
|
|
if err := scanner.Err(); err != nil {
|
|
return nil, fmt.Errorf("read %s: %w", path, err)
|
|
}
|
|
return c, nil
|
|
}
|